# Ubuntu patches multiple Apache HTTP Server vulnerabilities

> **Key takeaway:** Ubuntu has released security updates for Apache HTTP Server to address vulnerabilities including remote code execution, denial of service, and authentication bypass.

**Published:** 2026-10-14T18:21:58+00:00 
**Source:** Ubuntu Security & Release Notices 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/ubuntu-patches-multiple-apache-http-server-vulnerabilities.html 

## Summary
Ubuntu has issued security notice USN-8931-1 to address several vulnerabilities in the Apache HTTP Server. The fixes cover a range of issues affecting various Ubuntu LTS releases, including potential remote code execution, HTTP response smuggling, and information disclosure via WebDAV and user directories.

## Vulnerability details
- **CVE-2026-63292**: Incorrect handling of certain HTTP requests could allow remote code execution or denial of service.
- **CVE-2026-63718**: Incorrect interpretation of backend HTTP responses could lead to HTTP response smuggling (affects Ubuntu 20.04, 22.04, 24.04, and 26.04 LTS).
- **CVE-2026-73636**: Improper validation of Digest authentication requests could allow a machine-in-the-middle attacker to bypass authentication.
- **CVE-2026-63045**: Improper validation of FTP server responses could allow a forward proxy to connect to an arbitrary host.
- **CVE-2026-58415** and **CVE-2026-79768**: Vulnerabilities in WebDAV and user directory access restrictions could lead to sensitive information disclosure.

## Why it matters
Users running Apache HTTP Server on Ubuntu LTS versions should apply these updates immediately to mitigate risks of remote exploitation and data exposure.